From: Simon Josefsson Date: Sun, 13 Apr 2008 10:13:11 +0000 (+0200) Subject: Document how to generate CRLs. X-Git-Tag: gnutls_2_3_5~24 X-Git-Url: http://git.ipfire.org/gitweb.cgi?a=commitdiff_plain;h=3acf331ee7f3dc310a18b2b9b476a0d851e2bb32;p=thirdparty%2Fgnutls.git Document how to generate CRLs. --- diff --git a/NEWS b/NEWS index fccdbf94f8..f8618e475c 100644 --- a/NEWS +++ b/NEWS @@ -5,6 +5,9 @@ See the end for copying conditions. * Version 2.3.5 (unreleased) +** Document how to generate CRLs. +Suggested by "Rainer Gerhards" . + ** Documented the --priority option to gnutls-cli and gnutls-serv. ** Several minor fixes in the OpenPGP interface. Thanks to Daniel Kahn diff --git a/THANKS b/THANKS index bb302145e9..520d7a2ddb 100644 --- a/THANKS +++ b/THANKS @@ -75,6 +75,7 @@ Dennis Vshivkov Kristofer T. Karas Marc Haber Tim Mooney +Rainer Gerhards ---------------------------------------------------------------------- Copying and distribution of this file, with or without modification, diff --git a/doc/gnutls.texi b/doc/gnutls.texi index 527c23ddd3..612e126c55 100644 --- a/doc/gnutls.texi +++ b/doc/gnutls.texi @@ -3056,6 +3056,27 @@ $ certtool --generate-proxy --load-ca-privkey key.pem \ --outfile proxy-cert.pem @end example +@item +To create an empty Certificate Revocation List (CRL) do: + +@example +$ certtool --generate-crl --load-ca-privkey x509-ca-key.pem --load-ca-certificate x509-ca.pem +@end example + +To create a CRL that contains some revoked certificates, place the +certificates in a file and use @code{--load-certificate} as follows: + +@example +$ certtool --generate-crl --load-ca-privkey x509-ca-key.pem --load-ca-certificate x509-ca.pem --load-certificate revoked-certs.pem +@end example + +@item +To verify a Certificate Revocation List (CRL) do: + +@example +$ certtool --verify-crl --load-ca-certificate x509-ca.pem < crl.pem +@end example + @end itemize Certtool's template file format: